Spanning Tree (STP) Cheat Sheet
Command reference for Cisco IOS Spanning Tree Protocol (STP/RSTP) on Catalyst switches: choose the mode, steer the root bridge, tune per-VLAN path cost and port priority, harden edge ports, and verify. Commands are global config unless a row notes (interface) or (EXEC); lowest Bridge ID (priority, then MAC) wins the root election.
Part of the Spanning Tree (STP) learning hub
Mode & root bridge
Set the STP mode, then force or elect the root per VLAN. Bridge priority must be a multiple of 4096 (default 32768).
| Command | What it does |
|---|---|
spanning-tree mode rapid-pvst | Set mode to Rapid PVST+ (per-VLAN RSTP). Alternatives: spanning-tree mode pvst | mst. |
spanning-tree vlan <id> root primary | Macro: lower this switch's priority (to 24576, or 4096 below the current root) so it becomes root for the VLAN(s). One-time; not dynamic. |
spanning-tree vlan <id> root secondary | Macro: set priority 28672 so this switch is the backup root. |
spanning-tree vlan <id> priority <0-61440> | Manually set bridge priority in steps of 4096 (default 32768). Lower value wins the election. |
Port cost & priority (per-VLAN, interface)
Applied under the interface; influences root-port and designated-port selection. Lower cost/priority is preferred.
| Command | What it does |
|---|---|
spanning-tree vlan <id> cost <1-200000000> | Set the interface path cost for the VLAN (default derives from bandwidth). Lowest cumulative cost to root chooses the root port. |
spanning-tree vlan <id> port-priority <0-240> | Set port priority in increments of 16 (default 128). Tie-breaker when path costs are equal; lower wins. |
Edge / port protection
PortFast speeds host ports to forwarding; BPDU Guard and Root Guard defend the topology. Global 'default' forms apply switch-wide.
| Command | What it does |
|---|---|
spanning-tree portfast [edge] | Interface (access port): skip listening/learning so the port forwards immediately. The 'edge' keyword is used on newer IOS/IOS-XE. |
spanning-tree bpduguard enable | Interface: err-disable the port the instant any BPDU is received — protects PortFast edge ports from a rogue switch/loop. |
spanning-tree guard root | Interface: ignore superior BPDUs and put the port in root-inconsistent (blocking) state, keeping the root where you designed it. |
spanning-tree portfast default | Global: enable PortFast automatically on all non-trunk (access) ports. |
spanning-tree portfast bpduguard default | Global: enable BPDU Guard automatically on every PortFast-enabled port. |
Verification (EXEC)
Run from privileged EXEC to confirm root, roles, states, and edge-protection status.
| Command | What it does |
|---|---|
show spanning-tree | All VLANs: root and local bridge IDs, port roles/states, and path costs. |
show spanning-tree vlan <id> | STP details for one VLAN, including whether 'This bridge is the root'. |
show spanning-tree root | Per-VLAN root bridge ID, root path cost, and the local root port toward it. |
show spanning-tree summary | Mode, PortFast/BPDU Guard/Loop Guard defaults, and a count of ports per state. |
show spanning-tree interface <if> detail | Per-port role, state, cost, priority, and BPDU transmit/receive counters. |
Frequently asked questions
What's the difference between 'spanning-tree vlan <id> root primary' and setting the priority by hand?
'root primary' is a one-time macro: IOS reads the current root's priority and sets this switch to 24576 (or 4096 below the current root) so it wins the election right now — it does not keep tracking future changes. 'spanning-tree vlan <id> priority <value>' sets an exact value you manage yourself, which must be a multiple of 4096. Both change the bridge priority, and the lowest Bridge ID (priority first, then MAC) becomes root.
Do I need both PortFast and BPDU Guard on access ports?
Yes, they solve different problems. PortFast skips the listening/learning delay so a host port forwards immediately, but it does nothing if someone plugs a switch into that port and creates a loop. BPDU Guard err-disables the port the moment it receives any BPDU, shutting down that risk. Pair them per-port (spanning-tree portfast + spanning-tree bpduguard enable) or switch-wide (spanning-tree portfast default + spanning-tree portfast bpduguard default).
How do I confirm which switch is the root bridge for a VLAN?
Run 'show spanning-tree vlan <id>' or 'show spanning-tree root'. If the output says 'This bridge is the root,' this switch is the root for that VLAN; otherwise it lists the Root ID, the root path cost, and the local root port pointing toward the root. Remember the lowest priority (then lowest MAC) wins.
Now build it
Labs that drill this on real Cisco IOS — configure it yourself, then grade your config against the answer key.
Stop memorizing — configure it on real Cisco IOS
A cheat sheet gets you unstuck; a graded lab makes it stick. Edit a real Cisco config and grade it instantly — free, no signup.